HAProxy in docker

Question

I'm trying to run haproxy on a docker, but it doesn't work.

Here's what I did:

1. Created Dockerfile that contains the following text:

FROM haproxy:2.3
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

2. This is my haproxy.cfg:

global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 10s
        timeout client  60s
        timeout server  60s
#        errorfile 400 /etc/haproxy/errors/400.http
#        errorfile 403 /etc/haproxy/errors/403.http
#        errorfile 408 /etc/haproxy/errors/408.http
#        errorfile 500 /etc/haproxy/errors/500.http
#        errorfile 502 /etc/haproxy/errors/502.http
#        errorfile 503 /etc/haproxy/errors/503.http
#        errorfile 504 /etc/haproxy/errors/504.http

frontend https_in
        mode tcp
        option tcplog
        bind *:443
        acl tls req.ssl_hello_type 1
        tcp-request inspect-delay 5s
        tcp-request content accept if tls
        
        acl host_server1 req.ssl_sni -i my1stdomain.com
        acl host_server2 req.ssl_sni -i my2nddomain.com

        use_backend https_Server if host_server1
        use_backend https_NUC if host_server2

backend https_Server
        mode tcp
#        option tcplog
        option ssl-hello-chk
        server Server 10.0.0.10:443

backend https_NUC
        mode tcp
#        option tcplog
        option ssl-hello-chk
        server NUC 10.0.0.40:443

3. The purpose is to point SSL port 443 of my1stdomain.com to LAN IP 10.0.0.10 and my2nddomain.com to IP 10.0.0.40

4. The docker is supposed to sit on 10.0.0.44, so these are the commands I ran:

docker build -t my-haproxy .

Result:

Sending build context to Docker daemon  4.096kB
Step 1/2 : FROM haproxy:2.3
 ---> 397cf3d55fac
Step 2/2 : COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
 ---> Using cache
 ---> a5cc1ff3c0c6
Successfully built a5cc1ff3c0c6
Successfully tagged my-haproxy:latest

Then, I tested the config:

docker run -it --rm --name haproxy-syntax-check my-haproxy haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg
Configuration file is valid

Then, I try to run it:

docker run -d --name haproxy --restart=always -p 10.0.0.44:443:443/tcp my-haproxy
a253dbce7341e454353e9a2b4278e22ae8172ed106aeec7

But, when I run docker ps, I see that it's not really running:

docker ps
CONTAINER ID   IMAGE                                     COMMAND                  CREATED              STATUS                          PORTS                                                                    NAMES
a253dbce7341   my-haproxy                                "docker-entrypoint.s…"   About a minute ago   Restarting (1) 12 seconds ago                                                                            haproxy

Any suggestion?

Answer 1

Instead of always restarting it, you should check the failure logs of this container. You can remove -d flag from your command to run this container in foreground in order to get logs on stdout:

docker run --name haproxy --restart=always -p 10.0.0.44:443:443/tcp my-haproxy

I used your haproxy.cfg to check the issue. I found the following two problems in the container logs:

• You are using /var/lib/haproxy for chroot but this directory can't be created by a non-root user. So, you can explicitly create it and change ownership to haproxy user.
• In stats socket /run/haproxy/admin.sock command, /run/haproxy directory needs to be created.

So, your Dockerfile should be updated like this to make it work:

FROM haproxy:2.3
RUN mkdir --parents /var/lib/haproxy && chown -R haproxy:haproxy /var/lib/haproxy
RUN mkdir /run/haproxy
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg